It may reuse existing one (`prev`), if no changes were made. If `prev` is
nil, always fetches a new copy from the datastore.

If auth_service URL is not configured, returns special kind of authdb.DB that
implements some default authorization rules (allow everything on dev server,
forbid everything and emit errors on real GAE).